Ctrl Wallet Ios Security Report background image
Home - Coinspect Security
Ctrl WalletCtrl WalletiOS
Search
Ctrl Wallet logo

Ctrl Wallet

Also on Android Android Chrome Chrome
Security Score

57.0

dApp Permissions

27.1 / 35
  • Pass Confirmation for requests from WalletConnect
    9.0 / 9.0 Expand details
    Description

    Requires user confirmation for requests from WalletConnect before granting dApp access to specific RPC methods.

    • The wallet breaks the connection and fails to process the wallet_watchAsset RPC endpoint properly, yet it still requires user confirmation for other DApp requests.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-ff213ab8.png
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass User confirmation for requests from embedded browser
    7.9 / 7.9 Expand details
    Description

    Requires user confirmation before processing privileged RPC requests from embedded browsers.

    • It lacks an embedded browser.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-cc9c5f9b.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Wallet unlock before requests
    5.5 / 5.5 Expand details
    Description

    Requires users to unlock it before processing dApp requests when in a locked state.

    • Require the user to unlock the wallet before processing each DApp request.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-e43405d2.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Mismatching EIP-712 chainId detection
    0.0 / 3.5 Expand details
    Description

    Alerts users or rejects signing EIP-712 messages with a mismatched chain ID.

    • The wallet doesn't refuse to sign an EIP-712 message with a chainId that does not match the currently active chain.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-e47248b6.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass eth_sign method disabled
    3.3 / 3.3 Expand details
    Description

    Restricts the use of the deprecated and insecure eth_sign method by default.

    • The wallet used personal_sign, converted to bytes.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
    ctrl-wallet-ios-36.4.1-da348903.jpgctrl-wallet-ios-36.4.1-b92c4cac.png
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Mismatching SIWE domain detection
    0.0 / 1.8 Expand details
    Description

    Warns users when the domain in a Sign-In with Ethereum (EIP-4361) message does not match the requesting dApp's origin.

    • The wallet does not warn users of a domain or scheme mismatch when signing SIWE message.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-59fb49c0.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Connected dApp management
    1.5 / 1.5 Expand details
    Description

    Allows users to list and revoke connected dApps.

    • The wallet displays a list of connected DApps and allows users to revoke access either individually or all at once.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-cfc12f6c.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Token approval management
    0.0 / 1.5 Expand details
    Description

    Allows users to view and revoke token approvals.

    • The wallet doesn't offer the ability to list and revoke token approvals via in-app functionality or links to external DApps.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
    ctrl-wallet-ios-36.4.1-81ff49b1.jpgctrl-wallet-ios-36.4.1-d3552a92.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail User confirmation before switching chains
    0.0 / 1.1 Expand details
    Description

    Requires user confirmation before switching the active chain.

    • The wallet switches chains without requiring user confirmation.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
    ctrl-wallet-ios-36.4.1-b46db428.pngctrl-wallet-ios-36.4.1-b4f96b76.jpg
    Last updated on Nov 14, 2025
    Report an issue Report an issue with this check

Intent Verification

13.8 / 25
  • Pass Transaction simulation
    6.7 / 6.7 Expand details
    Description

    Previews the expected outcome by simulating the request execution on the blockchain before signing.

    • The wallet does not display incoming or outgoing assets for pool requests but clearly shows them for swap requests.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 4 screenshots
    ctrl-wallet-ios-36.4.1-70ed05f4.jpgctrl-wallet-ios-36.4.1-617f76bf.jpgctrl-wallet-ios-36.4.1-d62d6c59.jpgctrl-wallet-ios-36.4.1-a84b0362.png
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Clear token approval dialog
    0.0 / 6.7 Expand details
    Description

    Clearly displays all the key details for ERC-20 Approve requests.

    • The wallet doesn't provide a clear interface for users to review the approved transaction details. The wallet only displays the approval contract, not the spender.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
    ctrl-wallet-ios-36.4.1-93ea2a74.jpgctrl-wallet-ios-36.4.1-56b2f3de.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Clear message signing dialog
    3.8 / 3.8 Expand details
    Description

    Clearly displays all message signature request details without truncating or hiding information.

    • The wallet displays large messages in personal sign requests without truncation and shows the verifying contract in the EIP-712 object.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
    ctrl-wallet-ios-36.4.1-f38a0689.jpgctrl-wallet-ios-36.4.1-522f1ec7.jpgctrl-wallet-ios-36.4.1-b3f43a18.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail EIP-712 message parsing
    0.0 / 2.4 Expand details
    Description

    Displays human-readable details for EIP-712 signature requests from well-known protocols.

    • The wallet displays EIP-712 objects as plain data without parsing them.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
    ctrl-wallet-ios-36.4.1-77f392a6.jpgctrl-wallet-ios-36.4.1-3bfefd0b.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Invalid address checksum detection
    2.2 / 2.2 Expand details
    Description

    Warns users when they input addresses with invalid EIP-55 checksums.

    • The wallet allows transactions to addresses with invalid checksums by auto-correcting them when provided by a DApp, but the transaction doesn’t go through. When the address is entered manually, it shows an invalid address alert.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 5 screenshots
    ctrl-wallet-ios-36.4.1-b91317a9.pngctrl-wallet-ios-36.4.1-f19a4b30.pngctrl-wallet-ios-36.4.1-fd7c3c6d.jpgctrl-wallet-ios-36.4.1-e71a8a28.jpgctrl-wallet-ios-36.4.1-813b8358.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Mandatory message review
    0.0 / 2.1 Expand details
    Description

    Requires users to review all the details before signing a message.

    • The sign button is available from the start.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
    ctrl-wallet-ios-36.4.1-ab88fb0d.jpgctrl-wallet-ios-36.4.1-e899610e.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Links to blockchain explorers
    1.2 / 1.2 Expand details
    Description

    Consistently provides clickable links to block explorers for all key blockchain identifiers.

    • The wallet provides clickable links in both historical transactions and transaction previews.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
    ctrl-wallet-ios-36.4.1-3fad1be5.jpgctrl-wallet-ios-36.4.1-ab8baa92.jpgctrl-wallet-ios-36.4.1-43a463a8.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check

Physical Access

10.5 / 20
  • Pass Seed phrase access control
    5.4 / 5.4 Expand details
    Description

    Requires authentication to access seed phrases or private keys.

    • The wallet prompts the user's face id before displaying the recovery phrase.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
    ctrl-wallet-ios-36.4.1-d7686f18.jpgctrl-wallet-ios-36.4.1-6da10354.jpgctrl-wallet-ios-36.4.1-5750abea.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Manual wallet lock
    0.0 / 3.9 Expand details
    Description

    Allows users to lock it manually.

    • The wallet doesn't include a manual lock option within the settings menu.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-2a2a1d47.png
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Automatic wallet lock
    0.0 / 3.9 Expand details
    Description

    Verifies wallet auto-locks on inactivity, device lock, or background.

    • The wallet includes an auto-lock feature, but it takes more than a minute.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-bd78e3a3.png
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Robust Authentication
    3.3 / 3.3 Expand details
    Description

    Uses strong authentication, such as resistance to trivial or commonly-used passwords. Including biometrics and rate limiting in mobile.

    • The wallet supports biometrics and mandates its use once enabled, without requiring a password or passcode.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 3 screenshots
    ctrl-wallet-ios-36.4.1-c399138c.jpgctrl-wallet-ios-36.4.1-0221c095.jpgctrl-wallet-ios-36.4.1-7b348631.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Clipboard seed phrase leak prevention
    0.0 / 1.8 Expand details
    Description

    Limits exposure of secrets by restricting or warning on copying seed phrases or taking screenshots.

    • The wallet allows copying mnemonics or private keys to the clipboard without adequately warning about the risks or limiting their duration.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-80424241.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Seed phrase access warning
    1.8 / 1.8 Expand details
    Description

    Warns users of the risk before allowing access to seed phrases or private keys.

    • The wallet provides a clear warning about the risks of sharing mnemonics and private keys before revealing them. It also requires users to check a box confirming they won’t share them.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-61087614.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check

Threat Prevention

5.5 / 20
  • Fail Phishing dApp detection
    0.0 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious URL.

    • The wallet doesn't alert about connections to known phishing DApps.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-c7ec8512.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Malicious address detection
    0.0 / 5.1 Expand details
    Description

    Prevents or alerts users about interactions with a known malicious address.

    • The wallet does not alert users when sending funds to known phishing addresses, such as the Tornado Cash attacker address when using the DApp.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-b6158fa3.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Trusted dApp detection
    3.3 / 3.3 Expand details
    Description

    Informs users when interacting with a trusted dApp URL.

    • The wallet informs users when they are interacting with well-known, verified URLs (DApps) like Uniswap.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-e28d1707.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Fail Unknown address detection
    0.0 / 2.8 Expand details
    Description

    Warns users when interacting with an unknown address.

    • The wallet does not warn the user when trying to send funds to an unknown address.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 2 screenshots
    ctrl-wallet-ios-36.4.1-6a71713c.jpgctrl-wallet-ios-36.4.1-efb459dd.jpg
    Last updated on Nov 17, 2025
    Report an issue Report an issue with this check
  • Fail Full dApp URL display
    0.0 / 1.5 Expand details
    Description

    Clearly displays the full dApp URL in the connection prompt.

    • The wallet doesn't display the full URL of the DApp without truncation when users attempt to connect.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-1c1b5ea2.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass Malicious or spam token filtering
    1.3 / 1.3 Expand details
    Description

    Hides malicious tokens and NFTs by default.

    • The wallet effectively filters out spam and scam NFTs.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-d19042b7.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check
  • Pass dApp access disclosure dialog
    1.0 / 1.0 Expand details
    Description

    Informs dApp access to balances, history, and signing requests on connection.

    • The wallet notifies users in the connection dialog that connecting allows the DApp to access their balance, and activity, and request transaction approvals.

      — Verified by Alejo Sequeira at Coinspect
    Evidence · 1 screenshot
    ctrl-wallet-ios-36.4.1-43cbe3fd.jpg
    Last updated on Oct 21, 2025
    Report an issue Report an issue with this check

This ranking is for informational purposes only. It should not be relied on to provide legal, tax, financial, investment, or other types of advice. Coinspect does not guarantee or warrant the accuracy, completeness, timeliness, suitability, or validity of the information provided and will not be responsible for any claim attributable to reliance on errors, omissions, or other inaccuracies of any part of such information.